System and method for intelligent information gathering and analysis

ABSTRACT

A system and method for intelligent information gathering and analysis. Information is gathered from plurality of open sources such as markets, investigations, government databases, internet intelligence, and public records. The gathered information is parsed and linked based on marketplace activities including threats. The parsed and linked information is sent to a database where queries can be applied to produce dossiers on entities. A client may add his own information to enrich a dossier and reports may be made based on the dossiers. Alerts may be generated when certain predefined conditions are met. These alerts can be used to drive various actions.

RELATED APPLICATIONS

This application claims priority to provisional application 60/632,854filed Dec. 3, 2004, entitled “Method and System for Evidence andIntelligence Acquisition and Analysis”, the entirety of which is herebyincorporated by reference.

COPYRIGHT NOTICE

A portion of the disclosure of this patent document contains materialwhich is subject to copyright protection. The copyright owner has noobjection to the facsimile reproduction by anyone of the patent documentor the patent disclosure, as it appears in the Patent and TrademarkOffice patent files or records, but otherwise reserves all copyrightrights whatsoever.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The invention relates to information collection and analysis and, moreparticularly, relates to the collection of data from a plurality ofdistinct sources and linking that information in light of marketplaceactivity to acquire richer and more detailed information about anentity.

2. Description of the Related Art

Threats to the marketplace are continuously evolving, becoming morecomplex and more prevalent. Some statistics show that 7-9% of globaltrade, and 10% of the sales on the Internet, relate to counterfeitgoods. Counterfeiting is a multi-dimensional problem. If the goods beingsold are drugs, for example, an ingested counterfeit drug may result inserious health consequences. If the drug is diverted and sold through adifferent distribution channel than originally intended, the drug mayend up in a different country, be sold for below or above market price,be sold in a country without conforming to necessary regulations, andthe company manufacturing the drug may lose significant profits and/orbe charged with misleading the public in its sales. It is desirable toacquire as much information about the sale of products and services soas to limit these exposures.

In recent years, Internet retailers of counterfeit and diverted goodshave increasingly leveraged the Internet to directly market infringingproducts to global consumers. Internet retailers are combining websites,advertising portals, affiliate programs, banner advertisements, searchengine placements, and unsolicited bulk email to reach a far broader andwealthier consumer demographic than was historically accessible to blackand gray markets.

The act of acquiring intelligence and evidence on particular activitiesis necessary in many endeavors. In the legal arena, acquiring solid,highly reliable evidence is crucial in advancing a party's theory in acase. If the evidence acquired does not have a certain minimum level ofveracity, it may not even be admissible in courts of law. Forbusinesses, acquiring intelligence about competitors is beneficial indetermining marketing strategies. Businesses may even desire to learnmore information about how their own businesses are operating. Complexbusinesses using many different supply chains and/or distributionchannels, may desire to learn more about the entities in channels theyare using to ensure that products are not given to distributors who havea history of diverting or counterfeiting goods.

Some prior art intelligence and evidence acquisition methods gatherinformation about an entity from open sources such as government recordsor court filings. Those records include basic information about anentity such as an address, company name, etc. If two entities share someof the same information (e.g. they share the same address) some priorart methods are capable of even linking these two entities andindicating that they are related in some manner. Other prior art systemsreceive limited data about an entity from a client but do not supplementsuch data with information available to the public from open sources.For example, in response to a query relating to Product X, these priorart systems may indicate that there are 10,000 sellers of product X butwill not link that information with openly available sources ofinformation.

Such prior art systems are also generally static in that they typicallyrepresent a snapshot in time of information gathered about an entityfrom limited sources. These systems do not evolve to provide an updatedview of an entity as more information is acquired about the entity.Further, there is no means in the prior art systems for intelligentlinking of acquired information.

Thus, there is a need in the art for a system and method for acquiringmore complete information about an entity, and intelligently linkingthat information.

SUMMARY OF THE INVENTION

One embodiment of the invention is a system for acquiring informationabout an entity. The system comprises a server effective to gather firstinformation about an entity from open sources and a processor connectedto the server, the processor effective to generate a dossier on theentity based on the first information from the open sources. The systemfurther comprises a receiver connected to the server and processor, thereceiver effective to receive second information about the entity from aclient; wherein the processor is effective to modify the dossier basedon the second information from the client to produce a modified dossier.

Another embodiment of the invention is a system for acquiringinformation about an entity. The system comprises a server effective togather information about an entity; and a processor connected to theserver, the processor effective to process the information and determinemarketplace activity of the entity; wherein the server is effective toreceive additional information about the entity; and the processor iseffective to modify the dossier based on the additional information andthe marketplace activity to produce a modified dossier.

Still another embodiment of the invention is a product produced by theprocess of: gathering pieces of information about an entity; linking thepieces of information based on a marketplace activity of the entity toproduce linked information; and generating an electronic product on theentity based on the linked information.

Yet another embodiment of the invention is a method for processinginformation about an entity, the method comprising gathering a pluralityof pieces of information about an entity; parsing the plurality ofpieces of information to produce parsed information; and linking atleast some of the plurality of pieces of information based onmarketplace activity of the entity.

Still yet another embodiment of the invention is a display comprising: arepresentation of a client and a representation of a customer. Thedisplay further comprises a representation of a distribution channelused in moving a product from the client to the customer, therepresentation of the distribution channel including a link to at leastone dossier on at least one entity in the distribution channel, thedossier including information about the entity gathered from open andclosed sources.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a flow diagram illustrating a process for gatheringinformation and enabling searching on the information in accordance withan embodiment of the invention.

FIG. 2 is a system diagram illustrating a system for gatheringinformation and enabling searching on the information in accordance withan embodiment of the invention.

FIG. 3 is a flow diagram illustrating a process for gatheringinformation and enabling searching on the information in accordance withan embodiment of the invention.

FIG. 4 is a system diagram illustrating a system for gatheringinformation and enabling searching on the information in accordance withan embodiment of the invention.

FIG. 5 is a diagram illustrating an example of a dossier which could beproduced in accordance with an embodiment of the invention.

FIG. 6 is a diagram illustrating a map linking dossiers in accordancewith an embodiment of the invention.

FIG. 7 is a representation of a display which could be produced inaccordance with an embodiment of the invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT(S)

Referring to FIG. 1, there is shown a process for acquiring informationabout an entity in accordance with an embodiment of the invention. Anentity may include a person, a business, an endeavor (such ascounterfeiting, drug trafficking, diverting etc.), a product, or aservice, for which it is desired that information be acquired. At stepS2, the process gathers information from open sources. Open sources ofinformation include, for example, information that is available to thepublic such as through the Internet, license records, businessdirectories, advertisements, corporate records, and corporate filings.As discussed in more detail below, even though the information isavailable to the public, the collection of particular types of opensource information has not heretofore been gathered together in theprior art. At step S4, the process gathers information from closedsources. Such closed sources could include, for example, informationthat is not available to the public—such as information gathered or onlyavailable from a particular client, confidential information,information gathered off of computers seized pursuant to a court order,investigative reports from a client or third party, product analysisfrom a client or third party, business analysis from a client or thirdparty, etc. At step S6, a database is generated including theinformation acquired from the open and closed sources. Prior art systemsdid not have the ability to combine such closed source information withopen source information. At step S8, the process enables searching to beperformed on the information in the database. A more detailedexplanation of each of the steps is set forth below.

Referring to FIG. 2, there is shown a system 50 in accordance with anembodiment of the invention. System 50 could be used to implement, forexample, the process shown in FIG. 1. System 50 includes an analystterminal 62 which could be accessed by an analyst 64. As shown in thefigure, analyst 64 and terminal 62 may have access to many differentsources of open source information such as markets 52, investigations54, government data 56, internet intelligence 58 and public records 60.Markets 52 may include, for example, information about distributors,retailers, importers/exporters, re-labelers, re-exchangers, catalogues,and financials for a desired market. Investigations 54 may include, forexample, information such as investigation files from sources such asEDDI, Inc., law firm files, clients, private investigators, or otherhuman intelligence acquired by analyst 64. Government data 56 mayinclude, for example, import and export databases such as OASIS/FIARS,parallel traders, FDA and pharmacy licensing databases. InternetIntelligence 58 may include, for example, trade forums, trade bulletinboards, internet storefronts, auctions, WHOIS databases, file textprotocol information, Internet Service Provider databases, IRC (Internetrelay chat) logs, HREF images, unsolicited email trap accounts, SMS(short message service) trap accounts, voice over IP (VOIP) trapaccounts, Usenet groups, and chat room logs. Email trap accounts may beused to collect unsolicited email as described in, for example,copending application entitled “Information Security ThreatIdentification Analysis and Management”, Ser. No. 10/954,806 filed Jan.9, 2004, the entirety of which is hereby incorporated by reference. Forexample, trade boards may be spidered looking for desiredinformation—for example information about sales of product ABC. Publicrecords 60 could include, for example, business filings, court dockets,government inquiries, and media.

For each of these sources, a snapshot of the original acquired data maybe maintained in an evidence database 63 before being sent to a linkingand parsing server 66 (discussed below). In this way, reliable evidencemay be stored and later used if needed. In addition to the open sourcesmentioned above, a client using system 50 may request that certainsources of information be accessed. For example, the client may desirethat a certain trade board be analyzed or spidered for product ABC.Analyst 64 may be used to review trade board sites that are not amenableto algorithmic spiders.

For example, if a customer utilizing system 50 desired to know moreinformation about drug XYZ, analyst 64 would consult open sources 52,54, 56, 58 and 60 to acquire intelligence regarding drug XYZ. Entitieswho distribute, sell, import, or export drug XYZ or list drug XYZ incatalogues or their financials will be identified through market sources52. Ongoing investigations such as private investigations or EDDI filesrelating to entities dealing with drug XYZ are identified frominvestigations sources 54. Government information about drug XYZincluding pharmacy licensing is acquired from government sources 56.Trade forums, chat rooms, WHOIS databases etc. are consulted for drugXYZ as the internet intelligence sources 58. Public records 60 are alsoqueried regarding drug XYZ.

All of the open source information gathered by analyst 64 is then fed toa parsing and linking server 66. A link may be created between evidencestored in evidence database 63 and the evidence parsed by parsing server66. Parsing and linking server 66, along with analyst 64, parses thegathered information so that it may all be fed into a single platformdatabase 68. Parsing and linking server 66 combines unstructuredinformation, such as web pages and emails, with structured information,such as phone numbers, names, addresses, etc. into an organizeddatabase. Although only a single parsing and linking server 66 is shown,as large volumes of unstructured information may be received, aplurality of parsing and linking servers may be employed and implementedin a parallel. A centralized parsing and linking server may be used as ahub to coordinate parsing and linking activities and act as a centralpoint for the distribution of raw intelligence to multiple disparatespoke parsing and linking servers. The spoke parsing and linking serversmay operate independent of one another. Such an arrangement may provideincreased scalability.

For example, if an electronic document is acquired by terminal 62,parsing and linking server 66 may crawl through the document searchingfor phone numbers, email addresses, domain names, URLs in a messagebody, root domains of URLS in the message body, root domains in themessage header, DNS host names and root names, record creation date,record last updated date, registrant name, registrant address,registrant email, registrant phone number, types of registrants, etc.Trace routes, where a request from server A ends up going to a server B,may be tracked by analyst 64 and the information fed to server 66 sothat any intermediate internet protocol addresses and domains may betracked and captured. For trade boards, information such as the date ofan offer, an identification of the trade board, a URL of the offer, atype of listing, the text of the offer, the company listed in the offer,the company location listed, any websites listed in the offer, emailaddresses, persons listed in the offer page, mail addresses, and phonenumbers may all be parsed by parsing server 66.

Parsing and linking server 66 and analyst 64 also link pieces of thereceived information together based on relationships among the receivedinformation so that more intelligent analysis of the gatheredinformation is available. For example if information is acquired about aparticular web address, parsing and linking server 66, in combinationwith analyst 64, may access a WHOIS lookup and find out more informationabout the address. If an email trap account receives an unsolicitedemail regarding a drug XYZ, analyst 64 and parsing and linking server 66may look for domains relating to the email. Thereafter, a search may beperformed for other domains run by the same individual, where thosedomains are registered, etc. All of this information is linked togetherand stored in database 68.

Unlike the prior art, the linking performed by parsing and linkingserver 66 in conjunction with analyst 64 may be done with a focus onmarketplace activity including a threat by a malefactor. Examples ofmarketplace activity or threats by malefactors include counterfeiting,domain name hijacking, fraud, product diversion, hacking, phishing,virus-spreading, identity theft, digital piracy, sending unsolicitedemail, product hoarding, distribution contract violations, channelfraud, etc. Prior art techniques simply gathered together limitedinformation from sources and linked the information without anyparticular focus except perhaps to gather information about anindividual or business. Linking in system 50 is more intelligent. Forexample, by comparing received information relating to offers for saleagainst a taxonomy of countries and geographic regions, and linking thatinformation with parsed words like “buy”, “sell” and “offer”, system 50can classify perceived marketplace activities. As a consequence, system50 may determine, for example, whom an entity sells products to, shipsproducts to, etc. In this way, an entity may be associated withmarketplace activities which a potential to threaten a manufacturer'svalue chain.

Some examples of relationships among received data include a sharedadvertising channel—such as a mail house or advertising portal thatworks for multiple retailers; a shared product supplier anddistributor—the party that physically obtains and ships products orderedvia a given retail website; and a shared hosting company.

Once the open source data is parsed, linked and stored in platformdatabase 68, a query server 72 may be used to issue queries on platformdatabase 68 for particular entities. It should be noted that informationstored in database 68 may be continuously analyzed and linked together.As a large amount of information may be gathered on each entity, queryserver 72 can package this information from platform database 68 andproduce a file or dossier 70 for a particular entity. Three dossiers 70a, 70 b and 70 c are shown in FIG. 2. Dossiers 70 may be groupedtogether into logical containers such as cabinets. Dossiers 70 arediscussed in more detail below.

Referring to FIG. 3, there is shown a flow chart illustratingacquisition and analysis of information in accordance with an embodimentof the invention. The process of FIG. 3 could be implemented using, forexample, the system shown in FIG. 2. As shown in FIG. 3, at step S20,information is collected from various open sources including markets,investigations, government records, Internet intelligence, and publicrecords. At step S22, the information gathered in step S20 is parsed andcombined in a database. Based on the parsing, either an analyst orparsing server 66 may define a global rule. The global rule may be aBoolean condition or series of conditions based on parsed informationand may be stored in, for example, parsing and linking server 66. Thisglobal rule may then used in monitoring incoming data for matches andmay be used to automatically generate notifications or modify relevantdossiers (as is discussed in more detail below).

At step S24, pieces of the gathered information, either before or afterbeing stored in database 68, are linked based on marketplace activity.At step S26, searching is enabled on the database. At step S28, adossier is produced based on the search. Steps S20-S28 may be repeatedlyperformed and at step S30, the dossier may be updated based onmarketplace activity.

Referring to FIG. 4, there is shown a system 80 in accordance with anembodiment of the invention. As shown in the figure, system 80 mayinclude an operation side including platform database 68, discussedearlier, or any other database of information 89. Also shown is queryserver 72 and dossiers 70. In addition to information gathered from opensources, system 80 further includes a client side including a clientserver 82 which provides closed source information from a client 90.Client 90 is a client of an operator of system 80. Client 90 sendsclosed source client information 94 through a client server 82 and asecure channel 84 to a receiver 92. Secure channel 84 ensures thatinformation 94 sent from client 90 is received by a receiver 92 withoutbeing tampered. Secure channel 84 may be implemented using many knowntechniques in the art. Client information 94 received by receiver 92 maybe stored in a client database 88 and may be kept in a forensicallysound manner. For example, client database 88 may be kept separate fromall other databases.

Client information 94 may include, for example, information regardingwhere products were shipped by client 90, any returns or chargebacksreceived for the products, a list of customers of client 90, wholesalerand/or distributor data, a list of known incidents and/or complaintsregarding client 90 and its products or services, and any other track ortrace information.

Alternatively, other sources of closed source information 96 may beforwarded to receiver 92 and added to a closed source database 98accessible to query server 72. For example, a law firm may putinformation produced pursuant to discovery requests into closed sourcedatabase 98 or information from computers seized by authorities may beadded to closed source database 98. Depending on the nature of theinformation, closed source database 98, may also be kept separate fromclient database 88 and platform database 68. Alternatively, client 90may chose to purchase a dossier 70 c and move that information indossier 70 c to the client's side of system 80 so that additionalinformation from client 90 may be added to dossier 70 c so as to complywith confidentiality issues such as legal privilege.

Query server 72, in conjunction with analyst 64, may now issue querieson platform database 68, client database 88, closed source database 98and other database 89 to generate even richer dossiers 70 on entities.For example, a dossier 70 a created by information from platformdatabase 68 populated from open sources, may be supplemented withinformation from client 90 to produce an updated dossier 70 a thatincludes both open and closed sources of information. Further, oncedossier 70 a is updated with information from client 90, other pieces ofinformation from open sources in platform database 68 may now becomemore relevant and may be used to further supplement information indossier 70 a.

Dossiers 70 may each include a plurality of different types ofinformation about a particular entity. An example of a dossier 70 isshown in FIG. 5. While some types of data are shown in FIG. 5, thesetypes of data are meant to be illustrative only and not intended to beexhaustive. As shown in FIG. 5, a dossier 70 may be about a company 100.Primary class information 102 relating to industries that company 100 isactive in may be listed. Addresses 104 about company 100 may be shown aswell as revenue 106 and employees 108. A related intelligence itemsection 110 indicates available information about company 100. As shown,various intelligence fields 112 are available for company 100.Intelligence fields 112 include individuals, companies, addresses,phone/fax/mobile, profiles, licenses, assets, facilities, aliases,domains, email, IP addresses, etc. Each of the pieces of information inintelligence fields 112 has been determined by system 80 to be relatedto company 100 in some way. In the figure, the facilities intelligencefield for company 100 is shown in a detailed intelligence area 114.Detailed intelligence area 114 shows various facilities determined to berelated to company 100. A list of the related facilities is shown and ameasure of how strong (“str”) the relationship appears to be between thefacility and company 100. This strength rating may be established byanalyzing the number and types of links. The larger the number of links,the higher the strength rating. Links generated from structuredintelligence data sources may result in a higher strength rating thanthose generated from unstructured data sources.

Any of the intelligence fields 112 may be accessed to learn moreinformation about company 100. A listing 116 of the sources of theintelligence used to generate the dossier for company 100 is shown atthe bottom of the figure along with a link enabling the purchase ofcomplete briefs corresponding to the acquired intelligence. As isevident, the dossiers themselves may be linked together—such as adossier on an individual and a company may be linked. Similarly, if ananalyst decides that two or more dossiers relate to the same entity, theanalyst may choose to merge dossiers.

Dossier 70 shown in FIG. 5 also includes tabs 118. Clicking on a “Data”tab allows a user to view a collection of the raw intelligence relatedto the dossier input by analysts and the parsing and linking server. Thedata may include, for example, items such as Usenet posts, emails, webpages, message board posts, IRC and instant messenger logs, etc.Clicking on a “History” tab allows a user to see a list of changes toitems within the dossier. Clicking on an “Edit” tab allows an analyst tomake manual additions and/or edits to the contents of the dossier.

Clicking on a “Link It!” tab allows a user to generate and view a map ofthe relationships between dossier 70 and other dossiers based on relatedstructured information. Upon selection of the “Link It!” tab, a user isasked upon which original piece of information it would like to linkagainst and how many relationship levels it would like to link out fromthis original piece of information. For example, referring to FIG. 6,there is shown an example of a Link It! graph 200 in accordance with anembodiment of the invention. Graph 200 was produced by a user clickingon tab “Link It!” while viewing Dossier 1, selecting “phone number” asthe piece of information it wanted to link against, and selecting 2(two) relationship levels. As shown in FIG. 6, Dossier 1 shares thephone number “212-555-1212” with Dossier 2, Dossier 6, and Dossier 7.Similarly, Dossier 1 shares the phone number 312-555-1212 also withDossier 2 and shares the phone number 610-555-1212 with Dossier 4. Asthe user selected 2 relationship levels, phone numbers shared byDossiers 2, 4, 6 and 7 with other Dossiers are also shown in the figure.As shown, the phone number 609-555-1212 is shared by Dossier 2 andDossier 3. Dossiers 6 and 7 do not appear to share phone numbers withany other dossiers. Dossier 2 also shares phone number 310-555-1212 withDossier 4. In this way, a user can easily see relationship betweendossiers.

Other information about company 100 may also be included in dossier 70.For example, recent market intelligence about company 100 such as whocompany 100 ships to, sells to, what marketing language it uses, andcountries where it receives its products from—may be stored. Product andservice intelligence may be stored in dossier 70 such as products beingoffered for sale by company 100, and how system 80 knows about the offer(such as trade boards, internet stores, catalogues, fax blasts,auctions, forums, etc.). Threat intelligence about company 100 may bestored—such as whether company 100 has recently been a party in a legalproceeding—criminal or civil, OASIS information, FDA information,parallel trade licenses, etc.

Referring again to FIG. 4, client 90 may chose to issue queries 86 ondossiers 70. For example, client 90 may wish to see a dossier on aparticular entity or wish to see any dossiers which include informationrelating to a particular query. Client 90 may, for example, ask for anyinformation relating to drug XYZ. Any dossier 70 which includes suchinformation may be selected in response to queries 86. Further, adossier may be created for drug XYZ and may include information relevantto the drug such as known distributors, diverters, wholesalers,countries, of import and export, market price, etc.

Client 90 may request that reports 71 be generated based on dossiers 70as desired or may set up a continuous request to receive reports 71relating to a particular query every time new information relating tothe query is gathered. For example, every time information about drugXYZ is updated in one of the dossiers 70, client 90 may be notified. Orany time product ABC appears on a trade board, information in platformdatabase 68 and the corresponding dossier 70 is updated and client 90 isnotified. Client 90 may also choose to purchase a snapshot dossier 70showing information about an entity up to a particular point in time. Asshown in FIG. 4, client 90 may choose to purchase a snapshot dossier fordossier 70 c. Client 90 may then choose to add its own information 94 todossier 70 c on the client side of system 80. In this way, client 90 mayefficiently handle confidentiality issues and/or may add informationanonymously.

Dossiers 70 may be generated by analyst 64 or may be requested to begenerated by client 90. For example, client 90 may request that adossier of drug XYZ be generated. Further, client 90 may set forth rulesfor when a particular dossier should be updated. For example, for adossier on drug XYZ, client 90 may set up a rule that wheneverindividual K is found to be related to drug XYZ, the correspondingdossier on drug XYZ, or on individual K, should be updated.

Referring to FIG. 6, one example of a report which may be generated by aclient 90 may be a display 130 of a distribution channel 140 used byclient 90. If client 90 is a manufacturer of a product, such as drugXYZ, it may be desirable to analyze intelligence relating to entitieswho move the product from client 90 to a customer 142. If the productgoes through entity J and then entity K and finally to entity L, client90 may simply request a dossier for each one of those entities to seewhether any one of those entities has any relation to nefariousactivity. For example, display 130 may include a hyperlink to eachrespective dossier J, K, L and M so that client 90 viewing display 130can simply link to the respective dossier. Furthermore, upon viewing thedossiers for entities J, K and L, client 90 may learn that an additionalentity M has a relationship to entities J, K and L and perhaps M is alsoknown as selling drug XYZ—a fact which may have been previously unknownto client 90. Client 90 may now use this information in dealing withentities J, K, L and M.

Client 90 may use dossiers 70 to validate the authenticity of sourcesand contacts. Trends and patterns in the marketplace may be determinedthat may be actionable to client 90—such as fraud, theft, conversion,trademark infringement, etc. Client 90 may simply be interested indealing with a new entity and may use dossiers 70 to perform duediligence on this new entity.

Dossiers 70 may be used to discover relationships among entities. Forexample a query may be performed for all entities trading in drug XYZ.Such a query may yield 10 dossiers. Then, on those 10 dossiers, a querymay be performed to see who appears to be a counterfeiter or diverter.This may be accomplished by examining market data sections of receivedinformation for commercial activity summaries. If, for example, acompany is offering products below wholesale cost, the company is likelyinvolved in illicit activity. Similarly, if the company is offeringproducts in geographies distinct from where they list their addresses,there may be a presumption that the company is diverting and/orcounterfeiting a product.

That search may yield 4 dossiers. The search may be narrowed by howfrequently counterfeiting is performed. This may be determined by thevalue of offers collected by system 50. This last search may yield onlytwo dossiers. These remaining two dossiers represent the most relevantentities counterfeiting drug XYZ and the most important targets topursue. Prior art techniques could only list a number of individualsperforming counterfeiting, but could not provide an indication of themost relevant entities performing the counterfeiting System 80 enables auser to determine the most relevant entities, yields an evolving view ofthese entities, and is more automated than systems of the prior art.

Thus, by incorporating systems and/or methods in accordance with theinvention, more comprehensive and richer intelligence gathering andanalysis is achieved.

While the invention has been described and illustrated in connectionwith preferred embodiments, many variations and modifications as will beevident to those skilled in this art may be made without departing fromthe spirit and scope of the invention, and the invention is thus not tobe limited to the precise details of methodology or construction setforth above as such variations and modification are intended to beincluded within the scope of the invention.

What is claimed is:
 1. A method to update a data file, the methodcomprising: identifying, by a processor, contents of the data file,wherein the contents of the data file are categorized into intelligencefields, wherein the intelligence fields relate to particular types ofinformation among the contents of the data file, and wherein the datafile is stored in a first data structure stored in a memory; receiving aselection, by the processor, of a particular intelligence field in thedata file; searching, by the processor, the data file for matching dataamong the particular types of information, wherein the particular typesof information are categorized into the particular intelligence field;identifying, by the processor, a match between a first piece of data ofthe particular type of information and a second piece of data of theparticular type of information, wherein the first piece of data isrelated to a first entity, the first piece of data includes a first linkto a first source, the first source is stored in a second data structuredifferent from the first data structure, and wherein the second piece ofdata is related to a second entity, the second piece of data includes asecond link to a second source different from the first source, and thesecond source is stored in a third data structure different from thefirst data structure and the second data structure; determining, by theprocessor, that the first entity and the second entity are related basedon the match; updating the data file, by the processor, to produce anupdated data file, wherein the updated data file stored in the firststructure indicates a relationship between the first entity and thesecond entity; displaying, by the processor, at least some of thecontents of the updated data file related to the first entity and thesecond entity on a display; and storing the updated data file in thememory.
 2. The method of claim 1, wherein the first entity includes aperson, a business, a product, a facility, or a service.
 3. The methodof claim 1, wherein the intelligence fields include phone numbers, namesof individuals, names of facilities, addresses, profiles, uniformresource locators, internet protocol addresses, and/or emails.
 4. Themethod of claim 1, wherein the match is a first match, and the methodfurther comprises: receiving, by the processor, structured informationover a computer network; parsing, by the processor, the structuredinformation to produce pieces of unstructured information; andidentifying, by the processor, a second match between a first portion ofthe unstructured information and a second portion of the contents of thedata file; and wherein updating the data file further includesincorporating, by the processor, the structured information andunstructured information into the updated data file.
 5. The method ofclaim 1, wherein the relationship between the first entity and thesecond entity includes a strength rating, wherein the strength rating iscalculated based on a number of times the match between the first pieceof data and the second piece of data is identified by the processor. 6.The method of claim 1, wherein the data file is a first data file, andthe method further comprises: selecting an item of information fromamong the contents of the first data file; and linking the first datafile to at least one second data file, when the second data fileincludes the selected item of information.
 7. The method of claim 1,further comprising: generating a report based on the updated data file,wherein the report includes information related to the relationshipbetween the first entity and the second entity.
 8. The method of claim1, wherein the contents that are displayed by the processor arecategorized into the particular intelligence field, and wherein thedisplayed contents indicate a type of the relationship between the firstentity and the second entity.
 9. A computing device comprising: aprocessor; a memory configured to be in communication with theprocessor, and effective to store instructions; and the processoreffective to, in accordance with the instructions: identify contents ofa data file, wherein the contents of the data file are categorized intointelligence fields, wherein the intelligence fields relate toparticular types of information among the contents of the data file, andwherein the data file is stored in a first data structure stored in amemory; receive a selection of a particular intelligence field in thedata file; search the data file for matching data among the particulartypes of information, wherein the particular types of information arecategorized into the particular intelligence field; identify a matchbetween a first piece of data of the particular type of information anda second piece of data of the particular type of information, whereinthe first piece of data is related to a first entity, the first piece ofdata includes a first link to a first source stored in the memory, thefirst source is stored in a second data structure different from thefirst data structure, and wherein the second piece of data is related toa second entity, the second piece of data includes a second link to asecond source stored in the memory, the second source is different fromthe first source, and the second source is stored in a third datastructure different from the first data structure and the second datastructure; determine that the first entity and the second entity arerelated based on the match; and update the data file to produce anupdated data file, wherein the updated data file indicates arelationship between the first entity and the second entity; wherein thememory is further effective to store the updated data file; and whereinthe processor is further effective to cause at least some of thecontents of the data file related to the first entity and the secondentity to be displayed on a display.
 10. The computing device of claim9, wherein the first entity includes a person, a business, a product, afacility, or a service.
 11. The computing device of claim 9, wherein theintelligence fields include phone numbers, names of individuals, namesof facilities, addresses, profiles, uniform resource locators, internetprotocol addresses, and/or emails.
 12. The computing device of claim 9,wherein the match is a first match, and wherein the processor is furthereffective to: receive structured information over a computer network;parse the structured information to produce pieces of unstructuredinformation; and identify a second match between a first portion of theunstructured information and a second portion of the contents of thedata file; and wherein to update the data file the processor is furthereffective to incorporate the structured information and unstructuredinformation into the updated data file.
 13. The computing device ofclaim 9, wherein the relationship between the first entity and thesecond entity includes a strength rating, wherein the processor iseffective to determine the strength rating based on a number of timesthe match between the first piece of data and the second piece of datais identified by the processor.
 14. The computing device of claim 9,wherein the data file is a first data file, and the processor is furthereffective to: select an item of information from among the contents ofthe first data file; and link the first data file to at least one seconddata file, when the second data file includes the selected item ofinformation.
 15. The computing device of claim 9, wherein the processoris further effective to: generate a report based on the updated datafile, wherein the report includes information related to therelationship between the first entity and the second entity.
 16. Thecomputing device of claim 9, wherein the processor is further effectiveto categorize the displayed contents into the particular intelligencefield, and wherein the displayed contents indicate a type of therelationship between the first entity and the second entity.
 17. Aintelligence gathering system comprising: a first computing device,wherein the first computing device includes a first processor and afirst memory effective to be in communication with the first processor;a second computing device different from the first computing device,wherein the second computing device includes a second processor and asecond memory effective to be in communication with the secondprocessor; the first processor effective to: send a first source filestored in the first memory in a first data structure to the secondprocessor; send a second source file stored in the first memory in asecond data structure different from the first data structure to thesecond processor; the second processor effective to: receive the firstsource file and the second source file from the first processor; storethe first source file and the second source file in the second memory;parse the first source file to produce a first piece of data related toa first entity; parse the second source file to produce a second pieceof data related to a second entity; store the first piece of data andthe second piece of data in a data file in the second memory, whereinthe data file is stored in a third data structure different from thefirst and second data structures; identify a match between the firstpiece of data and the second piece of data, wherein the first piece ofdata includes a first link to the first source file and the second pieceof data includes a second link to the second source file; determine thatthe first entity and the second entity are related based on the match;and update the data file to produce an updated data file, wherein theupdated data file indicates a relationship between the first entity andthe second entity.
 18. The system of claim 17, wherein the first entityincludes a person, a business, a product, a facility, or a service. 19.The system of claim 17, wherein the relationship includes shared phonenumbers, names of individuals, names of facilities, addresses, profiles,uniform resource locators, internet protocol addresses, and/or emails.20. The system of claim 17, wherein the match is a first match, andwherein the second processor is further effective to: receive structuredinformation over a computer network; parse the structured information toproduce pieces of unstructured information; and identify a second matchbetween a first portion of the unstructured information and a secondportion of the contents of the data file; and wherein to update the datafile the processor is further effective to incorporate the structuredinformation and unstructured information into the data file.